External Alerts
editExternal Alerts
editGenerates a detection alert for each external alert written to the configured indices. Enabling this rule allows you to immediately begin investigating external alerts in the app.
Rule type: query
Rule indices:
- apm--transaction
- traces-apm*
- auditbeat-*
- filebeat-*
- logs-*
- packetbeat-*
- winlogbeat-*
Severity: medium
Risk score: 47
Runs every: 5m
Searches indices from: None (Date Math format, see also Additional look-back time)
Maximum alerts per execution: 10000
References: None
Tags:
- OS: Windows
- Data Source: APM
- OS: macOS
- OS: Linux
Version: 103
Rule authors:
- Elastic
Rule license: Elastic License v2
Setup
editSetup
This rule is configured to generate more Max alerts per run than the default 1000 alerts per run set for all rules. This is to ensure that it captures as many alerts as possible.
IMPORTANT: The rule’s Max alerts per run setting can be superseded by the xpack.alerting.rules.run.alerts.max Kibana config setting, which determines the maximum alerts generated by any rule in the Kibana alerting framework. For example, if xpack.alerting.rules.run.alerts.max is set to 1000, this rule will still generate no more than 1000 alerts even if its own Max alerts per run is set higher.
To make sure this rule can generate as many alerts as it’s configured in its own Max alerts per run setting, increase the xpack.alerting.rules.run.alerts.max system setting accordingly.
NOTE: Changing xpack.alerting.rules.run.alerts.max is not possible in Serverless projects.
Rule query
editevent.kind:alert and not event.module:(endgame or endpoint or cloud_defend)